Three requests can leave your machine, none carry case data
A short check that confirms your license is genuine. No case data, no file contents, no evidence.
A request to our update server to see whether a newer build of EMP Intake is available to download.
Online map resources may be requested by map views, Timeline Recon playback, or exports that render online basemaps. Requests go to a Falcrex-controlled map delivery service using Cloudflare infrastructure. They do not include case content.
What we collect, and what we don’t.
The short version. Every line maps to the formal language in the Privacy Policy.
Business & contact details
Name, company, business email and phone, billing contact, collected when you buy, request a demo, or contact us.
Licensing & transactions
License key and status, activation records, plan/edition, purchase and renewal details. Card details go to our payment processor, not to EMP.
Device & technical info
App version, OS and device type, and an installation/device identifier for licensing. EMP does not currently transmit automatic crash reports; diagnostic information leaves your environment only when you deliberately provide it to support.
Support & website info
Your messages and attachments, support history, and standard website data (IP, browser, pages visited, form submissions).
Your case files & evidence
In normal standalone use, case records, files, metadata, and evidence stay on your own device. EMP’s standard support process does not include routine uploading of case data to EMP.
Product usage analytics
EMP does not collect product usage analytics. No telemetry of file contents, filenames, or file paths.
Cloud copies of your data
EMP does not currently offer cloud sync, and there is no automatic backup of your cases to our servers.
Your data for resale
EMP does NOT sell personal information, and does NOT disclose it to third parties for their own unrelated marketing purposes.
Everything inside the boundary stays put.
In normal EMP Intake WS use, case files, filenames, notes, pins, evidence content, and case metadata stay on the workstation. EMP preserves original files and records SHA-256 hashes at intake. Limited network activity can occur for license activation or validation, update checks when enabled, and optional map resource requests when map views, Timeline Recon playback, or exports use online basemaps. These requests go to a Falcrex controlled map delivery service using Cloudflare infrastructure and do not include case content. File based offline activation is available on request for fully disconnected paid workstations; trials still require online validation. EMP does not provide cloud sync. EMP is no-cloud evidence management for core workstation use.
| Egress | When | Carries case data? | Required? |
|---|---|---|---|
| License/subscription validation | Activation and periodic validation | No case files or evidence content | Required for licensing |
| Software update check | When checking for updates, if enabled | No case files or evidence content | Optional/controlled |
| Optional/controlled map-resource requests via a Falcrex-controlled map delivery service using Cloudflare infrastructure | When map views, Timeline Recon, or exports use online basemaps | No evidence files; the map area viewed may be inferable from request patterns | Optional feature |
Built for review, not black-box trust.
When a file enters a case, EMP keeps the original untouched, records a SHA-256 hash so anyone can later recompute it, and writes the whole thing to the audit log. That intake discipline is designed to align with NIST SP 800-86 (forensic techniques in incident response) and NIST SP 800-101 (mobile device forensics). SP 800-101 references concern handling and exporting mobile-device evidence acquired elsewhere, not extraction from a device.
EMP is NIST SP 800-86 aligned, a design target, not a certification. It is not FIPS-validated. It is tamper-evident, not tamper-proof, and it makes no claim to guarantee admissibility. The court decides that.
EMP Intake is a tool, not legal advice or a substitute for your own counsel, accreditation, or review. See Defensible by Design.
You do. We’re the software provider.
The customer organization that uses EMP Intake controls the Customer Data it enters. EMP acts as the software provider, not the primary decision maker for that data, and does not claim ownership of it.
You remain responsible for retention, deletion, backups, access controls, and lawful use within your own environment. Your rights to access, correct, or delete personal information are set out in the Privacy Policy, section 15.
The proof pack
Everything a procurement or security reviewer needs to check our claims, without taking our word for any of it. All of it already exists.
Plain language here. Full language there.
Privacy Policy →
What we collect, how we use it, your rights, and how to reach us.
Terms of Service →
The agreement for purchasing, subscribing to, and using the Services.
Security & disclosure →
Egress detail, third-party components, and how to report a vulnerability. Found a security issue? See our disclosure policy.
Run a real case. Watch where the data goes.
No card, no sales call. The best way to believe that your evidence stays where it already lives is to watch it on your own files.